LogPruner: detect, analyze and prune logging calls in Android apps

Dear editor, Android is a popular mobile operating system that is accounted for more than 87% of all smartphone sales in the second quarter of 2017. The number of available apps hosted in Google play store has reached to 3.5 M at the end of 2017 and is still counting. In developing apps, developers usually use log messages for debugging and diagnosing their apps in order to fix bugs or locate the performance bottlenecks [1, 2]. At release stage, the logging messages should be muted for security consideration and higher performance. However, our previous empirical study revealed that developers prefer to deactivate the logging calls instead of removing them [3]. By applying reverse engineering, malicious attackers can reactivate logging calls and steal sensitive personal information from log messages [4, 5]. Although we have proposed a tool to prune the logging calls as well as its dependent instructions based on a user predefined logging class configuration [3], it is difficult for developers to locate the logging class when apps getting more complicated, especially in third-party libraries. We further complement the work by providing a logging class detection algorithm that intends to ease developers’ work from scratch.